What type of attack should be used in order to pass this authentication

Question

I am practicing the Astalavista Wargames and i came across this challenge. The question is: Bob wrote a piece of software but the password verification doesn't seem to work. You must find a way to log on. We were able to recover some part of the source:

typedef struct {char pass[5],valid;} password;

int main(){
    password s;
    s.valid=0;
    scanf("%s",s.pass);
    verifypass(s);
    //if password is correct the value of s.valid will change to 1
    if(s.valid==1)login();
    else printf("Wrong passwordn");
    system("Pause");
    return 0;
}

Link to original provided executable file in the question . Note that the question does not provide anything else beside this part of code and executable file.

My initial thought was that this should be done using buffer overflow attacks, so just as a common approach on my x64 machine I try to enter 1 to change the valid bit to TRUE.

when I enter this number of 1's "1111111111111111111111111111" the program allows me to enter the password again, BUT not logging in. If I enter less, it would show the wrong password and exit and if I enter more it would crash.

How can I come up with a solution to this challenge?

Answer 1

You would be able to attack this with a buffer overflow, but it is not necessary. In order to get a buffer overflow exploit working you will need to perform dynamic analysis on the exe, using a tool such as OllyDBG. You would then run the program, passing it overlong strings until you get it to crash. The type of crash you are looking for is control over eip. Typically you would just pass a whole string of AAAAAA and check the CPU registers when the program crashes, if you see eip 0x41414141 or similar, you win and are just a few steps away from breaking the code.

However, I would attack this in a very different way. The password is stored in the exe file, but it is obfusticated - it is generated by multiplying and rotating a series of values such as 0x55555556 and 0x66666667. It then compares your password against the generated value, and branches one way or another depending on whether they match. All you need to do is subvert this branching condition. This can be achieved very easily with a hex-editor.

For a clue; the command you want to edit resides at 0x4013b3 (_main+58).